CVE-2020-17519: Path Traversal in Apache Flink
Summary
CVE-2020-17519: Path Traversal in Apache Flink. Affects org.apache.flink:flink-runtime_2.11 versions >= 1.11.0, < 1.11.3. Fixed in 1.11.3. How to fix ↓
Also tracked for
- flink · Bitnami
The same CVE-2020-17519 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Flink is an open-source stream processing framework for big data analytics and batch processing. It provides distributed processing capabilities and fault tolerance for large-scale data processing applications. The 'org.apache.flink:flink-runtime' package is a core component of Apache Flink that includes the runtime environment for executing Flink jobs. This package is vulnerable to a path traversal vulnerability that allows attackers to read arbitrary files on the local filesystem of the JobManager through the REST interface of the JobManager process.
Vulnerability Detail
The path traversal vulnerability in Apache Flink allows an attacker to access files on the local filesystem that are accessible by the JobManager process. By exploiting this vulnerability, an attacker can read sensitive information from the system, such as configuration files, credentials, or any other files accessible to the JobManager process. This can lead to unauthorized access, data leakage, and potential compromise of the entire Flink instance. The vulnerability was introduced in Apache Flink 1.11.0 and affects versions 1.11.0, 1.11.1, and 1.11.2. It has been fixed in versions 1.11.3 and 1.12.0.
How To Fix
Minimum fixed version
1.11.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to apply the recommended fix by upgrading to the patched versions of Apache Flink.
Conclusion
The path traversal vulnerability in Apache Flink can allow attackers to read arbitrary files on the local filesystem of the JobManager process. It is crucial to upgrade to the patched versions of Apache Flink (1.11.3 or 1.12.0) to mitigate this vulnerability. Failure to apply the necessary fixes can result in unauthorized access, data leakage, and potential compromise of the entire Flink instance. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.flink:flink-runtime_2.11 →
FAQ
Apache Flink is an open-source stream processing framework for big data analytics and batch processing. It provides distributed processing capabilities and fault tolerance for large-scale data processing applications.
The 'org.apache.flink:flink-runtime' package is a core component of Apache Flink that includes the runtime environment for executing Flink jobs. It is responsible for managing the execution of Flink applications and provides the necessary infrastructure for distributed processing.
A path traversal vulnerability, also known as directory traversal or file inclusion vulnerability, allows an attacker to access files or directories outside of the intended directory structure. In the case of Apache Flink, this vulnerability allows an attacker to read arbitrary files on the local filesystem that are accessible by the JobManager process.
The path traversal vulnerability in Apache Flink can lead to unauthorized access to sensitive information stored on the local filesystem. This can include configuration files, credentials, or any other files accessible to the JobManager process. The unauthorized access to such information can result in data leakage, unauthorized system modifications, or even complete compromise of the Flink instance.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Apache Flink instance is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file. It provides a comprehensive database of vulnerabilities and their impact on various packages and frameworks.
